Applications of Combinatorial Group Theory in Modern Cryptography

Transcription

1 Applications of Combinatorial Group Theory in Modern Cryptography Delaram Kahrobaei New York City College of Technology City University of New York Joint work with Bettina Eick (TU Braunschweig, Germany) Bilal Khan (City University of New York) Cryptography and Combinatorial Group Theory Seminar Graduate Center Cryptography Sub Seminar February 8 st 2008

2 Classical Diffie-Hellman (1976) y 2 Z m random Y g y mod m Public info m: large prime 1 < g < m k' = y = (g x ) y = g x y = (g y ) x = k To Break: Solve discrete log problem Y Y x 2 Z m random g x mod m

3 Non-commutative Diffie-Hellman y 2 T Y = g y = y -1 g y Public Info G: non-abelian f.g. group with solvable WP g 2 G; S, T < G s.t. [S, T] = {1} Y Y x 2 S = g x = x -1 g x

4 G: non-abelian f.g. group with solvable WP g 2 G; S, T < G s.t. [S, T] = {1} Y Y k' = y = (g x ) y = g x y = (g y ) x = Y x = k [x, y]=1 ) g x y = g y x To Break: Need to solve CP (Find x, y from g, = g x, Y = g y )

5 AKE (AAG) G: f.g. group with solvable WP (f.g.) S, T < G S= gp(s 1,, s n ); T=gp(t 1,, t m ) Alice & Bob want to agree on a key. public information: G, S, s 1,, s n, T, t 1,, t m a) Alice chooses a secret element a 2 S as a word in the generators a = s a1 i1 s al il and publishes t 1a,, t a m b) Bob chooses a secret element b 2 T as a word in the generators b = t i1 b1 t ih bh and publishes s 1b,, s n b Alice and Bob can use [a, b] as a shared secret.

6 Why k= [a, b]? [a, b] = (b -1 ) a b = ((t i1a ) b 1 (t iha ) b h) -1 b computable for Bob [a, b] = a -1 a b = a -1 ((s i1b ) a 1 (s ilb ) a l) computable for Alice To determine [a, b] based on the published data need to compute a and b.

7 ElGamal (1984) The ElGamal algorithm is an asymmetric encryption algorithm for public key cryptography, based on Diffie-Hellman key agreement. The ElGamal algorithm is widely used in the free GNU Privacy Guard software, recent versions of PGP, and several other Cryptosystems.

8 Classical ElGamal b r (b, c, p) (b, c, p) Prime p> Primitive root b mod p Choose 1<c<p b l =c mod p Private key: l Choose 0<x<p =(x.c r ) mod p Header b r

9 Classical ElGamal b r (b, c, p) (b r ) l = b r.l =(b l ) r =c r mod p.(c r ) -1 = x. c r.(c r ) -1 =x mod p To break: Solve Discrete Logarithm Given b, c, p b x c mod p Determine x

10 ElGamal (1984) The following is a list of cyclic groups, of which the first three have received the greatest attention in ElGamal schemes: Multiplicative group of integers modulo a prime. Multiplicative group of finite field of characteristic 2. Multiplicative group of the finite field F * q where q=p m, p a prime. Z * n the group of units--where n is a composite integer. The group of points on an elliptic curve over a finite field. The Jacobian of a hyperelliptic curve over a finite field. Class groups of imaginary quadratic number fields. In each of the above generalizations the security of the encryption scheme rests on the (unproven) difference in the complexity of multiplication and discrete logarithm, and more precisely, the socalled Decisional Diffie-Hellman (DDH) assumption.

11 Non-commutative ElGamal (2006) Kahrobaei-Khan h E (b,c) (b,c) Private key s2s b2g c=b s Public Info G: non-abelian f.p. group With Solvable WP S, T<G st [S,T]=1 t 2 T E= x (ct ) h= b t

12 Non-commutative ElGamal The feasibility of this scheme rests on the assumption that products and inverses of elements of G can be computed efficiently. h E (b,c) (b,c) (b t ) s =(b s ) t =c t E =(c t ) -1 (x (ct ) ) E =(x (c^t) ) (c^t)-1 = x To Break: Solve conjugacy search problem [Solving c=b s for s]

13 Non-Commutative Key Exchange using Power Conjugacy (2006) Kahrobaei-Khan Secret: s2s, n 2 N g 2 G v=g n w=s -1 g s w n =s -1 vs h E (g, v, w) Public Info G: non-abelian f.p. gp With Solvable SCP S, T<G [S,T]=1 (g, v, w) t2t, m 2 N To Encrypt x E=x -1 t -1 (v) m tx=x -1 t -1 g mn tx Header: h=t -1 w m t=t -1 s -1 g m st

14 Non-Commutative Key Exchange using Power Conjugacy h E v w E' =sh n s -1 =t -1 g mn t E = x -1 E' x Find x To Break: Solve Power Conjugacy Search Problem w n =s -1 g n s for n and s given g n and w